Due Diligence Checklist: 174 Documents Buyers Actually Request (2026)

Last updated: March 2026

I run Peony, a data room company, and I have helped set up hundreds of due diligence data rooms for M&A transactions, fundraising rounds, and PE buyouts. The single biggest pattern I see is this: sellers underestimate how many documents buyers will request and how precisely organized those documents need to be.

Bloomberg Law's standard M&A due diligence request list contains 174 document types across 10+ categories. That is the baseline law firms use when drafting diligence request letters. In practice, a mid-market data room holds 5,000 to 50,000+ pages of individual documents across those types.

This post is the definitive checklist. Every document type, organized by 10 categories, with industry overlays, staging guidance, common mistakes, and the exact structure I help clients build inside Peony data rooms.

TL;DR: Buyers request 174 document types across 10 categories (Bloomberg Law). Average due diligence now takes 203 days -- up 64% from a decade ago (Bayes Business School). 41% of dealmakers say completing DD is a top obstacle to closing (KPMG 2025). Peony (free, $0) uses AI auto-indexing to organize this entire 10-category structure in under 3 minutes, with page-level analytics and enterprise security (screenshot protection, dynamic watermarks, NDA gates).

If you need guidance on setting up a due diligence data room (platform choice, step-by-step process, security configuration), see our companion guide: Due Diligence Data Room: Setup Guide & Document Checklist. This checklist focuses on what documents to include and why buyers request each one.

Quick Navigation

By the Numbers: DD Statistics That Matter
The Master Checklist: 10 Categories
Industry Overlays
2026 Trends Reshaping DD
5 Common Mistakes That Delay Deals
How to Organize With Peony
Staged Disclosure Guide
FAQ

By the Numbers: DD Statistics That Matter

Before diving into the checklist, here is what the data says about due diligence in 2026. Every stat is sourced so you can verify it.

Metric	Value	Source
Standard DD document types	174 types	Bloomberg Law
Average DD processing time	203 days (up from 124 days pre-2013)	Bayes Business School / SS&C Intralinks, 900+ deals
Optimal DD length ("Goldilocks")	~139 days (highest completion rate, lowest premium, best returns)	Bayes / SS&C Intralinks
Completing DD as top closing obstacle	41% of dealmakers	KPMG 2025 M&A Deal Market Study
Acquisitions that fail to create value	70-75% (40,000-deal study)	Fortune, Nov 2024
Executives citing poor DD as main failure cause	60%+	Fortune, Nov 2024
Incomplete target info as DD hurdle	40% of respondents	SRS Acquiom 2025
Buyer questions from poor data room organization	Up to 30%	Admincontrol / DataRooms.org
Mid-market data room page volume	5,000-50,000+ pages	MnA Community
Typical data room users per deal	20-200 users	MnA Community
Average seller prep time	27 days before data room launch	Admincontrol

The Bayes Business School "Goldilocks" finding is worth internalizing: deals with medium-length DD (~139 days) achieved the highest completion rates, lowest acquisition premiums (22% vs. 30-33% for rushed or dragged-out processes), and best 12-month shareholder returns (+4% vs. market). Rushing through DD leads to overpaying; dragging it out signals unresolvable problems. A well-organized data room hits that sweet spot by eliminating the document-hunting delays that inflate timelines.

The Master Checklist: 10 Categories, 174 Document Types

This synthesized checklist draws from Bloomberg Law, DFIN, Morgan & Westfield, BPM, Diligent, and the M&A Leadership Council. Each category explains why buyers request these documents so you can anticipate follow-up questions.

1. Corporate & Governance (15-25 Documents)

Why buyers request this: Reviewers confirm authority to transact, true ownership structure, and whether any approvals or consents are needed before closing. Missing board consents or unclear cap table entries can stall a deal for weeks. For investor-specific expectations around these documents, see our data room for investors guide.

2. Financial (15-20 Documents)

Why buyers request this: This set validates earnings quality, trend durability, seasonality, and forecast realism. Buyers price risk rather than guess -- and they need granular data to do it.

3. Tax (10-15 Documents)

Why buyers request this: Clean tax posture avoids price chips and closing delays. Unreported sales tax obligations or missing nexus analysis are among the most common purchase-price adjustments.

4. Legal & Contracts (15-25 Documents)

Why buyers request this: Reviewers test whether revenue or supply could be interrupted by the deal. Contracts with change-of-control provisions (requiring consent to transact) and assignment restrictions are the most time-sensitive items -- discovering them late forces a scramble that can delay closing by months. Bloomberg Law specifically flags these as critical.

5. Customers & Revenue (10-15 Documents)

Why buyers request this: This answers three questions fast -- how concentrated is revenue, how predictable are renewals, and where growth will realistically come from. A single customer representing more than 25% of revenue is a red flag in every deal.

6. HR & Employment (10-15 Documents)

Why buyers request this: Buyers look for key-person risk, worker misclassification exposure, and the true cost to retain and scale the team. Morgan & Westfield emphasizes these as the three core HR diligence questions.

7. IP & Technology (15-20 Documents)

Why buyers request this: Reviewers confirm you own what you sell and that the technology stack is maintainable without unexpected license gaps or brittle dependencies. IP assignment gaps are the #1 document problem in technology M&A, according to Software Equity Group.

For AI-focused transactions, Skadden (2026 Insights) recommends adding: training data provenance, model performance benchmarks, data licensing agreements, and compute infrastructure details.

8. Security & Privacy (10-15 Documents)

Why buyers request this: Cybersecurity has overtaken ESG as the #1 due diligence priority, per SRS Acquiom's 2025 study of 150 senior investment bank executives. 73% of dealmakers would walk away from a deal with undisclosed cyber issues, and 62% of M&A deals are delayed by cybersecurity problems (Forescout, 2025).

Cautionary example: Verizon's acquisition of Yahoo saw a $350 million price reduction after Yahoo disclosed breaches affecting 500M+ and 1B+ user accounts during the DD process, plus $35M in SEC penalties and $80M in lawsuits.

9. Operations (10-15 Documents)

Why buyers request this: This gives a realistic view of near-term deliverables, support obligations, and operational resilience. Buyers need to understand what they are committing to before planning any post-close integration.

10. Regulatory & Compliance (10-15 Documents)

Why buyers request this: Reviewers need to understand whether staying compliant post-close will require new systems, staffing, or timeline. Active remediation plans or consent orders directly affect deal structure and pricing.

Additional categories that some deals require as standalone sections: Insurance (D&O, cyber, E&O, GL, property policies, coverage summaries, claims history), Litigation & Claims (pending/threatened matters, settlements, subpoenas), Real Estate & Facilities (leases, estoppels, deeds), and ESG / Environmental (permits, audits, remediation plans). For most deals, these fit within or alongside the 10 core categories above.

Industry Overlays: Additional Documents by Sector

The 10-category master checklist covers the foundation. These industry overlays add the sector-specific documents that buyers in each vertical will expect.

SaaS Companies

SaaS due diligence adds approximately 15 document types beyond the standard checklist. Sources: L40 Advisory, The SaaS CFO, Software Equity Group.

SaaS red flags (SureSwift Capital): Gross dollar retention below 85% signals product-market fit issues. Single customer over 25% of ARR. Founder as sole technical contributor. No SOC 2 or equivalent. Revenue recognized upfront rather than ratably.

Biotech & Pharma

IP and regulatory documents can constitute 40-60% of the total data room volume in biotech, vs. 10-15% in typical corporate M&A. Sources: Phoenix Strategy Group, Alacrita.

Real Estate

Phase I Environmental Site Assessment is mandatory for any commercial property acquisition to establish the "innocent landowner" defense under CERCLA. Sources: PropertyMetrics, Thompson Coburn LLP.

Real estate DD typically spans 30-90 days, sometimes up to 6 months for complex portfolios.

Manufacturing

Environmental and equipment documents are far more extensive in manufacturing DD. Buyers need to quantify deferred maintenance CapEx and environmental remediation liability, both of which directly affect purchase price. Sources: BluWave, Brightest.io.

Note: 42% of manufacturing M&A deals face cybersecurity incidents, often due to legacy operational technology (OT) systems (Infosys).

2026 Trends Reshaping Due Diligence

AI-Powered Document Review Is Becoming Standard

More than 60% of PE firms already use at least one GenAI tool for sourcing, screening, or diligence, and adoption is forecast to surge from 16% of deal teams in 2023 to 80% by 2028 (Bain & Company, Global PE Report 2025). AI-assisted teams cut diligence time by 60-80% -- from approximately one week of data summarization to one day (V7 Labs / Bain, 2025).

What AI does in DD today: auto-categorizes and indexes uploaded documents, extracts key clauses (change-of-control, assignment, termination) across hundreds of contracts, identifies financial discrepancies, answers natural-language questions across the data room, and processes multilingual documents for cross-border deals. Herbert Smith Freehills used an AI contract review platform to review hundreds of leases in a recent deal, with all outputs reviewed by lawyers for quality.

Peony's AI auto-indexing builds on this trend by categorizing uploaded documents into the standard DD folder structure automatically.

Cybersecurity DD Is Now Non-Negotiable

Cybersecurity has overtaken ESG as the #1 due diligence priority (SRS Acquiom, 2025). The average global cost of a data breach hit $4.88M in 2024, the steepest jump since the pandemic (IBM / Infosys). The Marriott-Starwood acquisition is a cautionary tale: Marriott acquired Starwood for $13.3B in 2016, then discovered a breach exposing approximately 400M guest records that had existed since 2014 -- resulting in a $123M GDPR fine.

The emerging standard cybersecurity DD checklist includes 12 items (see Category 8: Security & Privacy above), and I expect every serious M&A process in 2026 to include them.

ESG Requirements Are Bifurcating

U.S. deals are de-prioritizing ESG documentation (SRS Acquiom confirms the shift). But for deals involving EU-headquartered targets or buyers with EU exposure, ESG documentation remains critical. The EU CSRD scope was narrowed under the "Omnibus" simplification to companies with 1,000+ employees and EUR 450M+ turnover (Morgan Lewis, March 2026), and the CSDDD transposition was postponed to July 2028. The practical takeaway: include ESG documentation if your deal has any EU nexus, and confirm with counsel whether the narrowed scope applies to your situation.

5 Common Mistakes That Delay Deals

These are the five document-related mistakes I see most frequently in my work with Peony clients. Each one is backed by published research.

1. Missing IP Assignment Agreements

Founders, early employees, and contractors often lack proper IP assignment paperwork. If the company cannot prove it owns its core IP, the deal stalls or the price drops. This is the #1 document gap in technology M&A (Software Equity Group).

Fix: Audit IP assignments before launching the data room. Every person who wrote code, designed products, or created content should have a signed assignment on file.

2. Undiscovered Change-of-Control Provisions

Sellers often do not know which contracts require counterparty consent for a sale. Discovering this late forces a scramble that can delay closing by weeks or months (Bloomberg Law).

Fix: Run a contract-level search for "change of control," "assignment," and "consent" clauses before DD begins. Flag every contract that requires third-party approval to transfer.

3. Incomplete Cybersecurity Documentation

53% of organizations have discovered significant cybersecurity issues during DD that jeopardized a deal (Forescout, 2025). Many sellers have no documented security governance framework, incident history, or penetration test results.

Fix: Map your security posture to NIST CSF 2.0 or ISO 27001 before entering a process. If you have never had a penetration test, get one -- the results (even imperfect ones) show good faith.

4. Poor Data Room Organization

Up to 30% of all buyer questions stem from inability to find documents in the data room -- not missing documents, but poor organization (Admincontrol / DataRooms.org). This wastes time on both sides and erodes confidence.

Fix: Use the 10-category structure in this checklist. Consistent file naming (YYYY-MM_Category_Description.ext) and a brief "what's here" note at the top of each folder eliminate most navigation confusion. Peony's AI auto-indexing creates this structure automatically.

5. Over-Sharing Sensitive Documents Too Early

Releasing employee-level compensation data, customer-identifying information, and disclosure schedules to unqualified parties creates competitive intelligence risk and damages trust if the deal falls through.

Fix: Stage your disclosure in three phases (see the Staged Disclosure Guide below). Keep confirmatory-level documents gated behind NDA gates until both sides are aligned on terms.

How to Organize This Checklist With Peony

I built Peony specifically to solve the data room setup problem. Here is how the checklist above maps to an actual Peony data room.

Step 1: Upload Documents in Bulk

Drag and drop your files into a new Peony data room. You do not need to pre-sort them -- that is what AI does next.

Peony data room dashboard showing the main interface for uploading and managing due diligence documents

Step 2: AI Auto-Indexing Creates the Structure

Peony's AI auto-indexing categorizes your uploaded documents into the standard DD folder structure -- the same 10 categories in this checklist -- in under 3 minutes. No manual folder creation, no drag-and-drop sorting. The AI reads document content and assigns each file to the correct category.

This is where the time savings compound. Sellers spend an average of 27 days preparing documentation before launching a data room. With AI auto-indexing, the structural work that used to take days happens in minutes.

Step 3: Track Reviewer Engagement With Page-Level Analytics

Once your data room is shared, Peony's page-level analytics show you exactly which pages each reviewer reads, how long they spend on each document, and where they go back for a second look. This tells you which categories are getting scrutiny and where follow-up questions are likely.

Peony analytics dashboard displaying page-level engagement data for due diligence document review

For due diligence specifically, analytics answer critical questions: Is the buyer spending disproportionate time on the legal section (potential contract concerns)? Are they skipping the security category (or drilling into it)? Has the PE firm's operating partner reviewed the financials yet?

Security Features for DD Data Rooms

Every Peony data room includes the security controls that due diligence requires:

Dynamic watermarks that trace any leaked page to a specific viewer
Screenshot protection that blocks and logs capture attempts
NDA gates that require signature before document access
Email verification for visitor identity
Link expiration and instant revocation
Per-folder and per-document permissions for staged disclosure
Complete audit trails for every viewer action

These features are available on every plan, including the free tier.

Peony pricing page showing transparent plans for due diligence data room access

Staged Disclosure: What to Share at Each Phase

Instead of giving every reviewer access to everything, stage your disclosure in three phases. This is standard practice in M&A and fundraising, and it protects you if a process falls through.

Phase 1: Preliminary (All Qualified Parties)

Share after NDA execution with any party that passes initial qualification.

Company overview and corporate structure (Category 1 highlights)
High-level financial summary: revenue, growth rate, EBITDA or burn rate
Management team overview
Product/service overview
High-level market positioning

Purpose: Let buyers determine if the opportunity fits their thesis before committing resources to detailed review.

Phase 2: Detailed (Shortlisted Bidders)

Share with 2-5 parties that submit indicative bids or term sheets.

Full financial statements and projections (Category 2)
Complete tax filings and analysis (Category 3)
Material contracts with change-of-control analysis (Category 4)
Customer data with concentration analysis (Category 5)
IP portfolio and technology architecture (Category 7)
Security governance documentation (Category 8)
Operations and compliance (Categories 9-10)

Purpose: Give bidders enough information to submit binding offers and conduct substantive diligence.

Phase 3: Confirmatory (Final Bidder Only)

Share only with the selected bidder, near signing.

Employee-level compensation data and HR details (Category 6 sensitive items)
Individual customer contracts and pricing
Disclosure schedules attached to the definitive agreement
Sensitive litigation details and reserves
Confirmatory financial schedules

Purpose: Validate all representations and warranties before closing. This information is too sensitive to share with multiple competing bidders.

On Peony, you implement staged disclosure using per-folder permissions -- each phase maps to a permission group. As parties advance through the process, you expand their access without creating separate data rooms. NDA gates enforce signature requirements before any access, and link expiration ensures former bidders lose access when they exit the process.

For more detail on data room setup, permissions, and security configuration, see our complete Due Diligence Data Room Guide.

FAQ

How many documents do buyers typically request in due diligence?

Bloomberg Law's standard M&A due diligence request list contains 174 document types across 10+ categories. In practice, a mid-market deal data room holds 5,000 to 50,000+ pages of individual documents across these types. Peony's AI auto-indexing organizes uploaded documents into the standard 10-category structure in under 3 minutes, so sellers can populate a complete checklist without building folders from scratch.

What are the 10 categories of a due diligence checklist?

The standard 10 categories are: (1) Corporate & Governance, (2) Financial, (3) Tax, (4) Legal & Contracts, (5) Customers & Revenue, (6) HR & Employment, (7) IP & Technology, (8) Security & Privacy, (9) Operations, (10) Regulatory & Compliance. Some checklists also add Insurance, Litigation, Real Estate, and ESG as sub-categories. Peony data rooms use AI auto-indexing to sort uploaded files into these categories automatically.

How long does due diligence take in 2026?

Average DD processing time is 203 days as of 2023, up 64% from 124 days a decade earlier, according to a Bayes Business School study of 900+ global M&A deals. The optimal length is approximately 139 days: deals at that duration had the highest completion rates, lowest premiums (22%), and best 12-month shareholder returns (+4% vs. market). Peony's AI auto-indexing and page-level analytics help sellers launch data rooms faster, reducing the document-preparation bottleneck that extends timelines.

What documents do sellers most commonly forget in a data room?

The five most commonly missing documents are: IP assignment agreements for founders and contractors, contracts with change-of-control provisions, sales tax nexus analysis, contractor classification documentation, and historical board consents and minutes. Each gap can delay closing by weeks. Peony's AI auto-indexing flags missing categories when it organizes your uploads, so you can identify gaps before buyers do.

What is the difference between a due diligence checklist and a data room index?

A due diligence checklist is the master list of documents buyers request. A data room index is the actual folder structure and file inventory inside the virtual data room. The checklist drives the index: each checklist item should map to a specific folder and document in the room. Peony bridges the two by using AI auto-indexing to create the data room index directly from the standard checklist categories, ensuring nothing falls through the cracks.

How should I stage document disclosure during due diligence?

Best practice is three phases: Phase 1 (preliminary) shares the company overview, high-level financials, and corporate structure to all qualified parties. Phase 2 (detailed) releases full financials, material contracts, customer data, and IP documentation to shortlisted bidders after NDA execution. Phase 3 (confirmatory) opens sensitive schedules, employee-level data, and disclosure schedules only to the final bidder near signing. Peony supports staged disclosure with per-folder permissions, NDA gates, and link-level access controls.

Do I need different due diligence documents for SaaS versus traditional companies?

Yes. SaaS due diligence adds approximately 15 document types beyond the standard checklist: ARR/MRR bridge with cohort-level detail, net revenue retention analysis, CAC payback and LTV:CAC ratios, gross margin build separating software from services, deferred revenue schedules, hosting cost breakdowns, SOC 2 Type II reports, product usage metrics, and open-source license audits. Peony data rooms support SaaS-specific folder templates that include these categories alongside the standard 10.

Why does cybersecurity matter for due diligence in 2026?

Cybersecurity has overtaken ESG as the #1 due diligence priority according to SRS Acquiom's 2025 study. 73% of dealmakers would walk away from a deal with undisclosed cyber issues, and 62% of M&A deals are delayed by cybersecurity problems (Forescout, 2025). The Verizon-Yahoo deal saw a $350 million price reduction after breach disclosure. Peony helps sellers organize cybersecurity documentation (policies, pen test results, SOC 2 reports, incident history) within the Security & Privacy category of the data room.

How do I organize a due diligence data room with Peony?

Three steps: (1) upload your documents in bulk to a new Peony data room; (2) AI auto-indexing categorizes files into the standard 10-category due diligence structure in under 3 minutes; (3) set staged permissions, enable NDA gates and dynamic watermarks, and share secure links with reviewers. Peony's page-level analytics then show you exactly which documents each reviewer reads, so you can prioritize follow-ups. The entire setup takes under 5 minutes, compared to 20 to 40 hours for manual organization.

What is the cost of poor due diligence preparation?

Poor DD preparation has measurable costs: 70-75% of acquisitions fail to create value according to a 40,000-deal study, with more than 60% of executives citing poor due diligence as the main reason. 41% of dealmakers say completing DD is a top obstacle to closing (KPMG 2025). Extended timelines add 1-3 months for 59% of affected deals. Peony reduces preparation risk with AI auto-indexing that organizes documents in minutes, page-level analytics that track reviewer engagement, and staged access controls that prevent premature disclosure.

Related Resources

Due Diligence Data Room: Setup Guide & Document Checklist -- companion guide covering platform choice, setup process, and security configuration
Due Diligence Cost Breakdown -- what DD actually costs and where the money goes
Data Room for Investors -- setting up rooms specifically for fundraising
Best Data Rooms for Startups -- platform comparison for early-stage companies
Best Data Rooms for Private Equity -- PE-specific platform comparison
Virtual Data Room Cost Guide -- pricing across providers
Seed Funding Guide -- the fundraising process from first check to close
M&A Solutions -- how Peony supports M&A transactions
Due Diligence Solutions -- Peony's DD-specific capabilities
Private Equity Solutions -- Peony for PE firms
Legal Solutions -- Peony for legal teams running diligence
Peony Pricing -- transparent pricing, free tier available

Create Your Data Room

Due Diligence Checklist (174 Documents Buyers Actually Request) in 2026